Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research -  David Maynor

Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research (eBook)

(Autor)

eBook Download: EPUB
2011 | 1. Auflage
350 Seiten
Elsevier Science (Verlag)
978-0-08-054925-5 (ISBN)
Systemvoraussetzungen
50,15 inkl. MwSt
  • Download sofort lieferbar
  • Zahlungsarten anzeigen
This is the first book available for the Metasploit Framework (MSF), which is the attack platform of choice for one of the fastest growing careers in IT security: Penetration Testing. The book and companion Web site will provide professional penetration testers and security researchers with a fully integrated suite of tools for discovering, running, and testing exploit code.

This book discusses how to use the Metasploit Framework (MSF) as an exploitation platform. The book begins with a detailed discussion of the three MSF interfaces: msfweb, msfconsole, and msfcli .This chapter demonstrates all of the features offered by the MSF as an exploitation platform. With a solid understanding of MSF's capabilities, the book then details techniques for dramatically reducing the amount of time required for developing functional exploits.
By working through a real-world vulnerabilities against popular closed source applications, the reader will learn how to use the tools and MSF to quickly build reliable attacks as standalone exploits. The section will also explain how to integrate an exploit directly into the Metasploit Framework by providing a line-by-line analysis of an integrated exploit module. Details as to how the Metasploit engine drives the behind-the-scenes exploitation process will be covered, and along the way the reader will come to understand the advantages of exploitation frameworks. The final section of the book examines the Meterpreter payload system and teaches readers to develop completely new extensions that will integrate fluidly with the Metasploit Framework.

? A November 2004 survey conducted by CSO Magazine stated that 42% of chief security officers considered penetration testing to be a security priority for their organizations

? The Metasploit Framework is the most popular open source exploit platform, and there are no competing books

? The book's companion Web site offers all of the working code and exploits contained within the book
Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research is the first book available for the Metasploit Framework (MSF), which is the attack platform of choice for one of the fastest growing careers in IT security: Penetration Testing. The book will provide professional penetration testers and security researchers with a fully integrated suite of tools for discovering, running, and testing exploit code.This book discusses how to use the Metasploit Framework (MSF) as an exploitation platform. The book begins with a detailed discussion of the three MSF interfaces: msfweb, msfconsole, and msfcli .This chapter demonstrates all of the features offered by the MSF as an exploitation platform. With a solid understanding of MSF's capabilities, the book then details techniques for dramatically reducing the amount of time required for developing functional exploits.By working through a real-world vulnerabilities against popular closed source applications, the reader will learn how to use the tools and MSF to quickly build reliable attacks as standalone exploits. The section will also explain how to integrate an exploit directly into the Metasploit Framework by providing a line-by-line analysis of an integrated exploit module. Details as to how the Metasploit engine drives the behind-the-scenes exploitation process will be covered, and along the way the reader will come to understand the advantages of exploitation frameworks. The final section of the book examines the Meterpreter payload system and teaches readers to develop completely new extensions that will integrate fluidly with the Metasploit Framework. - A November 2004 survey conducted by "e;CSO Magazine"e; stated that 42% of chief security officers considered penetration testing to be a security priority for their organizations- The Metasploit Framework is the most popular open source exploit platform, and there are no competing books

Front Cover 1
Metasploit Toolkit: For Penetration Testing, Exploit Development, and Vulnerability Reasearch 2
Copyright Page 3
Contents 12
Chapter 1. Introduction to Metasploit 18
Introduction 19
Overview: Why Is Metasploit Here? 19
History of Metasploit 21
Metasploit Core Development 29
Technology Overview 31
Leveraging Metasploit on Penetration Tests 51
Understanding Metasploit Channels 54
Summary 76
Solutions Fast Track 77
Frequently Asked Questions 80
Chapter 2. Architecture, Environment, and Installation 82
Introduction 83
Understanding the Soft Architecture 83
Configuring and Locking Down Your System 84
Installation 88
Summary 92
Solutions Fast Track 92
Frequently Asked Questions 93
Chapter 3. Metasploit Framework and Advanced Environment Configurations 94
Introduction 95
Configuration High-Level Overview 95
Global Datastore 96
Module Datastore 97
Saved Environment 98
Summary 99
Solutions Fast Track 99
Frequently Asked Questions 100
Chapter 4. Advanced Payloads and Add-on Modules 102
Introduction 103
Meterpreter 103
VNC Inject 110
PassiveX 112
Auxiliary Modules 113
Automating the Pen-Test 116
Summary 118
Solutions Fast Track 118
Frequently Asked Questions 120
Chapter 5. Adding New Payloads 122
Introduction: Why ShouldYou Care about Metasploit? 123
Types of Payloads 123
Adding New Exploit Payloads 124
Adding New Auxiliary Payloads 135
Bonus: Finding 0day While Creating Different Types o f Payloads 144
Summary 145
Case Studies 146
Case Study 1. RaXnet Cacti Remote Command Execution 148
Case Study 2. Mercur Messaging 2005 SP3 IMAP Remote Buffer Overflow (CVE -2006-1255) 160
Case Study 3. SlimFTPd String Concatenation Overflow 176
Case Study 4. WS-FTP Server 5.03 MKD Overflow 186
Case Study 5. MailEnable HTTP Authorization Header Buffer Overflow 216
Appendix A. Advantages of Network Vulnerability Testing with Metasploit 3.0 228
Introduction 229
Vulnerability Scanning 229
How Metasploit Gives Sys 230
Admins a Vulnerability-Testing Advantage 16
Summary 231
Appendix B. Building a Test Lab for Penetration Testing 232
Introduction 233
Some Background 233
Setting up a Penetration Test Lab 235
Types of Pentest Labs 242
Selecting the Right Hardware 245
Selecting the Right Software 247
Running Your Lab 249
Selecting a Pentest Framework 252
Targets in the Penetration Test Lab 255
Other Scenario Ideas 261
Summary 263
Appendix C. Glossary of Technology and Terminology 264
Index 280

Erscheint lt. Verlag 18.4.2011
Sprache englisch
Themenwelt Sachbuch/Ratgeber
Informatik Netzwerke Sicherheit / Firewall
Informatik Theorie / Studium Kryptologie
Wirtschaft Betriebswirtschaft / Management
ISBN-10 0-08-054925-X / 008054925X
ISBN-13 978-0-08-054925-5 / 9780080549255
Haben Sie eine Frage zum Produkt?
EPUBEPUB (Adobe DRM)

Kopierschutz: Adobe-DRM
Adobe-DRM ist ein Kopierschutz, der das eBook vor Mißbrauch schützen soll. Dabei wird das eBook bereits beim Download auf Ihre persönliche Adobe-ID autorisiert. Lesen können Sie das eBook dann nur auf den Geräten, welche ebenfalls auf Ihre Adobe-ID registriert sind.
Details zum Adobe-DRM

Dateiformat: EPUB (Electronic Publication)
EPUB ist ein offener Standard für eBooks und eignet sich besonders zur Darstellung von Belle­tristik und Sach­büchern. Der Fließ­text wird dynamisch an die Display- und Schrift­größe ange­passt. Auch für mobile Lese­geräte ist EPUB daher gut geeignet.

Systemvoraussetzungen:
PC/Mac: Mit einem PC oder Mac können Sie dieses eBook lesen. Sie benötigen eine Adobe-ID und die Software Adobe Digital Editions (kostenlos). Von der Benutzung der OverDrive Media Console raten wir Ihnen ab. Erfahrungsgemäß treten hier gehäuft Probleme mit dem Adobe DRM auf.
eReader: Dieses eBook kann mit (fast) allen eBook-Readern gelesen werden. Mit dem amazon-Kindle ist es aber nicht kompatibel.
Smartphone/Tablet: Egal ob Apple oder Android, dieses eBook können Sie lesen. Sie benötigen eine Adobe-ID sowie eine kostenlose App.
Geräteliste und zusätzliche Hinweise

Buying eBooks from abroad
For tax law reasons we can sell eBooks just within Germany and Switzerland. Regrettably we cannot fulfill eBook-orders from other countries.

Mehr entdecken
aus dem Bereich
Das Praxishandbuch zu Krisenmanagement und Krisenkommunikation

von Holger Kaschner

eBook Download (2024)
Springer Fachmedien Wiesbaden (Verlag)
34,99
Methodische Kombination von IT-Strategie und IT-Reifegradmodell

von Markus Mangiapane; Roman P. Büchler

eBook Download (2024)
Springer Vieweg (Verlag)
42,99